Add ownership block in the frontend; return 404 page if permission denied